@composurecdk/bedrock 0.11.1 → 0.11.2

package/README.md

@@ -13,14 +13,6 @@ import { createModelAlarmBuilder, inferenceProfile, modelGrants } from "@composu
 const haiku = inferenceProfile.geographic({
   model: FoundationModelIdentifier.ANTHROPIC_CLAUDE_HAIKU_4_5_20251001_V1_0,
   geography: "eu",
-  routingRegions: [
-    "eu-central-1",
-    "eu-north-1",
-    "eu-south-1",
-    "eu-south-2",
-    "eu-west-1",
-    "eu-west-3",
-  ],
 });
 
 compose(
@@ -49,36 +41,57 @@ compose(
 
 A profile's id is derived from its model, so the id a caller invokes and the model it is granted cannot drift apart. Use `new FoundationModelIdentifier("…")` for a model newer than the installed CDK's constants.
 
-`routingRegions` are the Regions a geographic profile routes to from your source Region. They vary by source Region and are not derivable from the geography, so they are supplied rather than guessed: take them from the model's page in the Bedrock user guide or from `aws bedrock get-inference-profile`. The source Region is always included.
+### Routing Regions
 
-For an id that arrives as a string, such as from an environment variable:
+A geographic profile is owned by AWS. AWS chooses the Regions it routes to, which differ by source Region and grow over time without notice. You choose the profile, not its destinations.
+
+By default the grant therefore covers the foundation model in every Region, conditioned on `bedrock:InferenceProfileArn` so it is reachable only through that profile. The profile keeps requests inside its geography, so naming the destinations would not narrow where they run. A copy of the list would break the profile when AWS adds a Region. Bedrock checks the model in every Region the profile may route to before it routes a request, so one missing Region denies every call, not only those routed there.
+
+Pass `routingRegions` when the policy must name each Region: for a service control policy, or a policy scanner that flags a wildcard in any ARN. Take them from `aws bedrock get-inference-profile`, and re-check them when AWS changes the profile. The source Region is always included.
 
 ```ts
-const profile = inferenceProfile.parse(
-  "eu.anthropic.claude-haiku-4-5-20251001-v1:0",
-  routingRegions,
-);
-foundationModelFor(profile.profileId).modelId; // "anthropic.claude-haiku-4-5-20251001-v1:0"
+inferenceProfile.geographic({
+  model,
+  geography: "eu",
+  routingRegions: ["eu-central-1", "eu-west-3"],
+});
 ```
 
-`parse` and `foundationModelFor` throw on an id without a known geography or `global` prefix (`INFERENCE_PROFILE_GEOGRAPHIES`), rather than mistake a provider such as `anthropic.` for one.
+The default is not the shape in the Bedrock user guide's example, which lists each Region. It is the same statement with the Region left open, verified against live IAM ([#628](https://github.com/laazyj/composureCDK/issues/628)).
+
+### Ids that arrive as strings
+
+`inferenceTarget.fromId` resolves an id read from configuration or an environment variable:
+
+| Id                                  | Target                   |
+| ----------------------------------- | ------------------------ |
+| `anthropic.claude-…`                | A foundation model       |
+| `eu.anthropic.claude-…`, `global.…` | A system-defined profile |
+| `arn:…:provisioned-model/…`         | A provisioned model      |
+
+```ts
+const ids = ["anthropic.claude-sonnet-5-5", "us.anthropic.claude-haiku-4-5-20251001-v1:0"];
+createFunctionBuilder().grant(...ids.map((id) => modelGrants.invoke(inferenceTarget.fromId(id))));
+```
+
+It throws on a two-part id with an unknown prefix (`INFERENCE_PROFILE_GEOGRAPHIES`) rather than grant it as a model named after a geography. It also throws on an inference profile ARN, because the model the profile routes to cannot be read from it. `inferenceProfile.parse` and `foundationModelFor` accept only profile ids.
 
 Profiles are plain values rather than the alpha `CrossRegionInferenceProfile` L2, for the [reasons given for guardrails](#why-the-l1-constructs-not-the-alpha-l2) and because its grants don't match what live IAM needs ([#536](https://github.com/laazyj/composureCDK/issues/536)).
 
 ## Grants
 
-`modelGrants.invoke(target)` grants `bedrock:InvokeModel` and `bedrock:InvokeModelWithResponseStream`, which together cover `InvokeModel`, `Converse` and their streaming variants. Pass it to any grantee builder's `grant(...)`.
+`modelGrants.invoke(target)` grants `bedrock:InvokeModel` and `bedrock:InvokeModelWithResponseStream`, which together cover `InvokeModel`, `Converse` and their streaming variants. A caller that never streams can pass `{ streaming: false }` for `bedrock:InvokeModel` alone. Pass the grant to any grantee builder's `grant(...)`.
 
 | Target      | Statements                                                                                                                                                                                                   |
 | ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
 | Model       | The foundation model in the source Region                                                                                                                                                                    |
-| Geographic  | The profile; the foundation model in the source Region and every routing Region, conditioned on `bedrock:InferenceProfileArn`                                                                                |
+| Geographic  | The profile; the foundation model in every Region, or in the source Region and each listed routing Region, conditioned on `bedrock:InferenceProfileArn`                                                      |
 | Global      | The profile; the foundation model in the source Region; the Region-less foundation model ARN with `aws:RequestedRegion: unspecified`. Both model statements are conditioned on `bedrock:InferenceProfileArn` |
 | Application | The profile; its source's foundation models, conditioned on `bedrock:InferenceProfileArn` being the application profile                                                                                      |
 
 The model and system-profile rows follow the policies in the Bedrock user guide for [geographic](https://docs.aws.amazon.com/bedrock/latest/userguide/geographic-cross-region-inference.html#geographic-cris-iam-setup) and [global](https://docs.aws.amazon.com/bedrock/latest/userguide/global-cross-region-inference.html#global-cris-iam-setup) cross-Region inference. The `bedrock:InferenceProfileArn` condition makes the foundation models reachable only through the profile ([GENSEC01-BP01](https://docs.aws.amazon.com/wellarchitected/latest/generative-ai-lens/gensec01-bp01.html)); to also call a model directly, grant it separately. The application row was verified against live IAM for a global source: the source profile needs no statement of its own.
 
-`invocationArns(target, scope)` returns the same resource ARNs for policies you write yourself, such as service control policies.
+`invocationArns(target, scope)` returns the same resource ARNs for policies you write yourself, such as service control policies. For a geographic profile without `routingRegions` that is one Region-wildcard model ARN, so list the Regions when the policy needs them.
 
 ## Alarms
 
@@ -95,7 +108,7 @@ AWS publishes no recommended alarm thresholds for Bedrock. The [Generative AI Le
 | `timeToFirstToken`       | `TimeToFirstToken` (p90)       | opt-in, threshold required             |
 | `estimatedTpmQuotaUsage` | `EstimatedTPMQuotaUsage` (Max) | opt-in, `quota` required; 80% of quota |
 
-`invocationClientErrors` includes `AccessDenied`, so it catches an under-granted routing Region, which fails only for requests routed there. Missing data is not breaching. Defaults are exported as `MODEL_ALARM_DEFAULTS`.
+`invocationClientErrors` includes `AccessDenied`, so it catches a stale `routingRegions` list, which denies every call through the profile. Missing data is not breaching. Defaults are exported as `MODEL_ALARM_DEFAULTS`.
 
 ```ts
 createModelAlarmBuilder()
@@ -157,7 +170,14 @@ compose(
 
 By default the guardrail filters every harmful-content category (sexual, violence, hate, insults, misconduct) and prompt attacks at `HIGH`, with the Bedrock console's default blocked message (`GUARDRAIL_DEFAULTS`). Topic, word, sensitive-information and contextual-grounding policies depend on the workload and are not defaulted.
 
-`requireGuardrail` makes the grantee [use the guardrail](https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-permissions-id.html): the invoke allow is conditioned on `bedrock:GuardrailIdentifier`, an explicit deny refuses any other call, and the grantee may apply the guardrail. `guardrailGrants.apply` grants `bedrock:ApplyGuardrail` alone.
+`requireGuardrail` makes the grantee [use the guardrail](https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-permissions-id.html): the invoke allow is conditioned on `bedrock:GuardrailIdentifier`, an explicit deny refuses any other call, and the grantee may apply the guardrail. `guardrailGrants.apply` grants `bedrock:ApplyGuardrail` alone, and accepts a guardrail the app did not build as `{ guardrailArn, version }`.
+
+For a guardrail chosen at run time, such as one named in configuration:
+
+- `requireGuardrail: "any"` requires every call to carry some guardrail in the grantee's account and Region, and lets the grantee apply any of them.
+- `guardrailGrants.applyAny()` lets the grantee apply any guardrail in its account and Region, without requiring one. Use it where a call may or may not name a guardrail.
+
+Prefer a reference where the guardrail is known at synth.
 
 Guardrail errors and throttles are only published per account, so the guardrail's alarms are opt-in: `invocationsIntervened` (Sum) and `invocationLatency` (p90), each with a threshold you supply.
 

package/dist/commonjs/arn.d.ts

@@ -0,0 +1,12 @@
+import { Stack } from "aws-cdk-lib";
+import type { IConstruct } from "constructs";
+type Environment = Pick<Stack, "partition" | "region" | "account">;
+/**
+ * The partition, Region and account of `scope`'s stack, or the `AWS::`
+ * pseudo-parameters without a scope. @internal
+ */
+export declare function environmentOf(scope: IConstruct | undefined): Environment;
+/** A `bedrock` ARN with a slash-separated resource name. @internal */
+export declare function bedrockArn(partition: string, resource: string, resourceName: string, region: string, account?: string): string;
+export {};
+//# sourceMappingURL=arn.d.ts.map

package/dist/commonjs/arn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"arn.d.ts","sourceRoot":"","sources":["../../src/arn.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,KAAK,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,KAAK,WAAW,GAAG,IAAI,CAAC,KAAK,EAAE,WAAW,GAAG,QAAQ,GAAG,SAAS,CAAC,CAAC;AAEnE;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,UAAU,GAAG,SAAS,GAAG,WAAW,CAIxE;AAED,sEAAsE;AACtE,wBAAgB,UAAU,CACxB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,EACd,OAAO,SAAK,GACX,MAAM,CAUR"}

package/dist/commonjs/arn.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.environmentOf = environmentOf;
+exports.bedrockArn = bedrockArn;
+const aws_cdk_lib_1 = require("aws-cdk-lib");
+/**
+ * The partition, Region and account of `scope`'s stack, or the `AWS::`
+ * pseudo-parameters without a scope. @internal
+ */
+function environmentOf(scope) {
+    return scope === undefined
+        ? { partition: aws_cdk_lib_1.Aws.PARTITION, region: aws_cdk_lib_1.Aws.REGION, account: aws_cdk_lib_1.Aws.ACCOUNT_ID }
+        : aws_cdk_lib_1.Stack.of(scope);
+}
+/** A `bedrock` ARN with a slash-separated resource name. @internal */
+function bedrockArn(partition, resource, resourceName, region, account = "") {
+    return aws_cdk_lib_1.Arn.format({
+        partition,
+        service: "bedrock",
+        region,
+        account,
+        resource,
+        resourceName,
+        arnFormat: aws_cdk_lib_1.ArnFormat.SLASH_RESOURCE_NAME,
+    });
+}
+//# sourceMappingURL=arn.js.map

package/dist/commonjs/arn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"arn.js","sourceRoot":"","sources":["../../src/arn.ts"],"names":[],"mappings":";;AASA,sCAIC;AAGD,gCAgBC;AAhCD,6CAAyD;AAKzD;;;GAGG;AACH,SAAgB,aAAa,CAAC,KAA6B;IACzD,OAAO,KAAK,KAAK,SAAS;QACxB,CAAC,CAAC,EAAE,SAAS,EAAE,iBAAG,CAAC,SAAS,EAAE,MAAM,EAAE,iBAAG,CAAC,MAAM,EAAE,OAAO,EAAE,iBAAG,CAAC,UAAU,EAAE;QAC3E,CAAC,CAAC,mBAAK,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;AACtB,CAAC;AAED,sEAAsE;AACtE,SAAgB,UAAU,CACxB,SAAiB,EACjB,QAAgB,EAChB,YAAoB,EACpB,MAAc,EACd,OAAO,GAAG,EAAE;IAEZ,OAAO,iBAAG,CAAC,MAAM,CAAC;QAChB,SAAS;QACT,OAAO,EAAE,SAAS;QAClB,MAAM;QACN,OAAO;QACP,QAAQ;QACR,YAAY;QACZ,SAAS,EAAE,uBAAS,CAAC,mBAAmB;KACzC,CAAC,CAAC;AACL,CAAC"}

package/dist/commonjs/grants.d.ts

@@ -5,13 +5,25 @@ import { type InferenceTarget } from "./inference-target.js";
 /** Options for {@link modelGrants.invoke}. */
 export interface ModelInvokeGrantOptions {
     /**
-     * Requires every invocation to apply this guardrail version. The allow is
-     * conditioned on `bedrock:GuardrailIdentifier`, an explicit deny refuses
-     * calls without it, and the grantee may apply the guardrail.
+     * Requires every invocation to apply a guardrail. The allow is conditioned
+     * on `bedrock:GuardrailIdentifier`, an explicit deny refuses calls without
+     * it, and the grantee may apply the guardrail.
+     *
+     * A reference requires that guardrail version. `"any"` requires some
+     * guardrail in the grantee's account and Region, for a workload that picks
+     * its guardrail at run time; prefer a reference where the guardrail is
+     * known at synth.
      *
      * @see https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-permissions-id.html
      */
-    requireGuardrail?: Resolvable<GuardrailReference>;
+    requireGuardrail?: Resolvable<GuardrailReference | "any">;
+    /**
+     * Whether to grant `bedrock:InvokeModelWithResponseStream` alongside
+     * `bedrock:InvokeModel`. Set `false` for a caller that never streams.
+     *
+     * @default true
+     */
+    streaming?: boolean;
 }
 /**
  * Consumer-side grant helpers for invoking Amazon Bedrock models. Pass one to
@@ -27,14 +39,14 @@ export declare const modelGrants: {
      * Invoke the target through `InvokeModel`, `Converse` or their streaming
      * variants.
      *
-     * For a cross-Region profile this also grants the foundation model in the
-     * source Region and every Region the profile routes to, conditioned on
-     * `bedrock:InferenceProfileArn` so those models are reachable only through
-     * the profile.
+     * For a cross-Region profile this also grants the foundation model, in
+     * every Region or in the profile's listed `routingRegions`, conditioned on
+     * `bedrock:InferenceProfileArn` so the model is reachable only through the
+     * profile.
      *
      * @see https://docs.aws.amazon.com/wellarchitected/latest/generative-ai-lens/gensec01-bp01.html
      */
-    invoke: (target: Resolvable<InferenceTarget>, { requireGuardrail }?: ModelInvokeGrantOptions) => Grant<IGrantable>;
+    invoke: (target: Resolvable<InferenceTarget>, { requireGuardrail, streaming }?: ModelInvokeGrantOptions) => Grant<IGrantable>;
 };
 /**
  * Consumer-side grant helpers for Amazon Bedrock guardrails.
@@ -47,5 +59,11 @@ export declare const guardrailGrants: {
      * `ApplyGuardrail` API or a model invocation that names it.
      */
     apply: (guardrail: Resolvable<GuardrailReference>) => Grant<IGrantable>;
+    /**
+     * Apply any guardrail in the grantee's account and Region, for a caller
+     * that may name one at run time. Where the guardrail is known, `apply` it;
+     * where every call must carry one, `modelGrants.invoke(…, { requireGuardrail })`.
+     */
+    applyAny: () => Grant<IGrantable>;
 };
 //# sourceMappingURL=grants.d.ts.map

package/dist/commonjs/grants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grants.d.ts","sourceRoot":"","sources":["../../src/grants.ts"],"names":[],"mappings":"AAAA,OAAO,EAA6B,KAAK,UAAU,EAAmB,MAAM,qBAAqB,CAAC;AAClG,OAAO,EAAW,KAAK,KAAK,EAAY,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACpF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,KAAK,eAAe,EAAiC,MAAM,uBAAuB,CAAC;AAU5F,8CAA8C;AAC9C,MAAM,WAAW,uBAAuB;IACtC;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,UAAU,CAAC,kBAAkB,CAAC,CAAC;CACnD;AAmDD;;;;;;;;GAQG;AACH,eAAO,MAAM,WAAW;IACtB;;;;;;;;;;OAUG;qBAEO,UAAU,CAAC,eAAe,CAAC,yBACb,uBAAuB,KAC5C,KAAK,CAAC,UAAU,CAAC;CAOrB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,eAAe;IAC1B;;;OAGG;uBACgB,UAAU,CAAC,kBAAkB,CAAC,KAAG,KAAK,CAAC,UAAU,CAAC;CAItE,CAAC"}
+{"version":3,"file":"grants.d.ts","sourceRoot":"","sources":["../../src/grants.ts"],"names":[],"mappings":"AAAA,OAAO,EAA6B,KAAK,UAAU,EAAmB,MAAM,qBAAqB,CAAC;AAElG,OAAO,EAAW,KAAK,KAAK,EAAY,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACpF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAEjE,OAAO,EACL,KAAK,eAAe,EAIrB,MAAM,uBAAuB,CAAC;AAY/B,8CAA8C;AAC9C,MAAM,WAAW,uBAAuB;IACtC;;;;;;;;;;;OAWG;IACH,gBAAgB,CAAC,EAAE,UAAU,CAAC,kBAAkB,GAAG,KAAK,CAAC,CAAC;IAC1D;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AA8FD;;;;;;;;GAQG;AACH,eAAO,MAAM,WAAW;IACtB;;;;;;;;;;OAUG;qBAEO,UAAU,CAAC,eAAe,CAAC,oCACK,uBAAuB,KAC9D,KAAK,CAAC,UAAU,CAAC;CAOrB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,eAAe;IAC1B;;;OAGG;uBACgB,UAAU,CAAC,kBAAkB,CAAC,KAAG,KAAK,CAAC,UAAU,CAAC;IAIrE;;;;OAIG;oBAGW,KAAK,CAAC,UAAU,CAAC;CAKhC,CAAC"}

package/dist/commonjs/grants.js

@@ -3,52 +3,78 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.guardrailGrants = exports.modelGrants = void 0;
 const aws_iam_1 = require("aws-cdk-lib/aws-iam");
 const core_1 = require("@composurecdk/core");
+const arn_js_1 = require("./arn.js");
 const inference_target_js_1 = require("./inference-target.js");
+const INVOKE_ACTION = "bedrock:InvokeModel";
 /**
  * Streaming operations (`InvokeModelWithResponseStream`, `ConverseStream`)
  * require both actions.
  *
  * @see https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonbedrock.html
  */
-const INVOKE_ACTIONS = ["bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream"];
-/** The versioned identifier `bedrock:GuardrailIdentifier` carries. */
-function identifierOf(guardrail) {
-    return `${guardrail.guardrailArn}:${guardrail.version}`;
+const INVOKE_ACTIONS = [INVOKE_ACTION, "bedrock:InvokeModelWithResponseStream"];
+/**
+ * Every guardrail in `scope`'s account and Region. The versioned identifiers
+ * `bedrock:GuardrailIdentifier` carries (`…:guardrail/<id>:<version>`) match
+ * it as a `StringLike` pattern.
+ */
+function anyGuardrailArn(scope) {
+    const { partition, region, account } = (0, arn_js_1.environmentOf)(scope);
+    return (0, arn_js_1.bedrockArn)(partition, "guardrail", "*", region, account);
+}
+function requirementOf(guardrail, scope) {
+    if (guardrail === "any") {
+        const arn = anyGuardrailArn(scope);
+        return { like: true, identifier: arn, applyArn: arn };
+    }
+    return {
+        like: false,
+        identifier: `${guardrail.guardrailArn}:${guardrail.version}`,
+        applyArn: guardrail.guardrailArn,
+    };
 }
-function grantInvoke(target, grantee, guardrail) {
-    const statements = (0, inference_target_js_1.invocationStatements)(target, (0, inference_target_js_1.scopeOf)(grantee.grantPrincipal));
-    const identifier = guardrail && identifierOf(guardrail);
+function withGuardrail(conditions, required) {
+    const match = required.like ? "StringLike" : "StringEquals";
+    return {
+        ...conditions,
+        [match]: {
+            ...conditions?.[match],
+            "bedrock:GuardrailIdentifier": required.identifier,
+        },
+    };
+}
+function grantInvoke(target, grantee, guardrail, streaming) {
+    const scope = (0, inference_target_js_1.scopeOf)(grantee.grantPrincipal);
+    const actions = streaming ? INVOKE_ACTIONS : [INVOKE_ACTION];
+    const statements = (0, inference_target_js_1.invocationStatements)(target, scope);
+    const required = guardrail && requirementOf(guardrail, scope);
     for (const { resourceArns, conditions } of statements) {
         aws_iam_1.Grant.addToPrincipal({
             grantee,
-            actions: INVOKE_ACTIONS,
+            actions,
             resourceArns,
-            conditions: identifier
-                ? {
-                    ...conditions,
-                    StringEquals: {
-                        ...conditions?.StringEquals,
-                        "bedrock:GuardrailIdentifier": identifier,
-                    },
-                }
-                : conditions,
+            conditions: required ? withGuardrail(conditions, required) : conditions,
         });
     }
-    if (!guardrail)
+    if (!required)
         return;
     grantee.grantPrincipal.addToPrincipalPolicy(new aws_iam_1.PolicyStatement({
         effect: aws_iam_1.Effect.DENY,
-        actions: INVOKE_ACTIONS,
+        actions,
         resources: statements.flatMap((s) => s.resourceArns),
-        conditions: { StringNotEquals: { "bedrock:GuardrailIdentifier": identifierOf(guardrail) } },
+        conditions: {
+            [required.like ? "StringNotLike" : "StringNotEquals"]: {
+                "bedrock:GuardrailIdentifier": required.identifier,
+            },
+        },
     }));
-    grantApply(guardrail, grantee);
+    grantApply(required.applyArn, grantee);
 }
-function grantApply(guardrail, grantee) {
+function grantApply(guardrailArn, grantee) {
     aws_iam_1.Grant.addToPrincipal({
         grantee,
         actions: ["bedrock:ApplyGuardrail"],
-        resourceArns: [guardrail.guardrailArn],
+        resourceArns: [guardrailArn],
     });
 }
 /**
@@ -65,15 +91,15 @@ exports.modelGrants = {
      * Invoke the target through `InvokeModel`, `Converse` or their streaming
      * variants.
      *
-     * For a cross-Region profile this also grants the foundation model in the
-     * source Region and every Region the profile routes to, conditioned on
-     * `bedrock:InferenceProfileArn` so those models are reachable only through
-     * the profile.
+     * For a cross-Region profile this also grants the foundation model, in
+     * every Region or in the profile's listed `routingRegions`, conditioned on
+     * `bedrock:InferenceProfileArn` so the model is reachable only through the
+     * profile.
      *
      * @see https://docs.aws.amazon.com/wellarchitected/latest/generative-ai-lens/gensec01-bp01.html
      */
-    invoke: (target, { requireGuardrail } = {}) => (0, core_1.grantVia)((0, core_1.combine)({ target, guardrail: requireGuardrail }), ({ target: resolved, guardrail }, grantee) => {
-        grantInvoke(resolved, grantee, guardrail);
+    invoke: (target, { requireGuardrail, streaming = true } = {}) => (0, core_1.grantVia)((0, core_1.combine)({ target, guardrail: requireGuardrail }), ({ target: resolved, guardrail }, grantee) => {
+        grantInvoke(resolved, grantee, guardrail, streaming);
     }),
 };
 /**
@@ -87,7 +113,19 @@ exports.guardrailGrants = {
      * `ApplyGuardrail` API or a model invocation that names it.
      */
     apply: (guardrail) => (0, core_1.grantVia)(guardrail, (resolved, grantee) => {
-        grantApply(resolved, grantee);
+        grantApply(resolved.guardrailArn, grantee);
+    }),
+    /**
+     * Apply any guardrail in the grantee's account and Region, for a caller
+     * that may name one at run time. Where the guardrail is known, `apply` it;
+     * where every call must carry one, `modelGrants.invoke(…, { requireGuardrail })`.
+     */
+    // A plain Grant rather than grantVia: there is no resource to resolve, only
+    // the grantee's own account and Region.
+    applyAny: () => ({
+        applyTo(grantee) {
+            grantApply(anyGuardrailArn((0, inference_target_js_1.scopeOf)(grantee.grantPrincipal)), grantee);
+        },
     }),
 };
 //# sourceMappingURL=grants.js.map

package/dist/commonjs/grants.js.map

@@ -1 +1 @@
-{"version":3,"file":"grants.js","sourceRoot":"","sources":["../../src/grants.ts"],"names":[],"mappings":";;;AAAA,iDAAkG;AAClG,6CAAoF;AAEpF,+DAA4F;AAE5F;;;;;GAKG;AACH,MAAM,cAAc,GAAG,CAAC,qBAAqB,EAAE,uCAAuC,CAAC,CAAC;AAcxF,sEAAsE;AACtE,SAAS,YAAY,CAAC,SAA6B;IACjD,OAAO,GAAG,SAAS,CAAC,YAAY,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;AAC1D,CAAC;AAED,SAAS,WAAW,CAClB,MAAuB,EACvB,OAAmB,EACnB,SAAyC;IAEzC,MAAM,UAAU,GAAG,IAAA,0CAAoB,EAAC,MAAM,EAAE,IAAA,6BAAO,EAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;IACjF,MAAM,UAAU,GAAG,SAAS,IAAI,YAAY,CAAC,SAAS,CAAC,CAAC;IACxD,KAAK,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,UAAU,EAAE,CAAC;QACtD,eAAQ,CAAC,cAAc,CAAC;YACtB,OAAO;YACP,OAAO,EAAE,cAAc;YACvB,YAAY;YACZ,UAAU,EAAE,UAAU;gBACpB,CAAC,CAAC;oBACE,GAAG,UAAU;oBACb,YAAY,EAAE;wBACZ,GAAG,UAAU,EAAE,YAAY;wBAC3B,6BAA6B,EAAE,UAAU;qBAC1C;iBACF;gBACH,CAAC,CAAC,UAAU;SACf,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,SAAS;QAAE,OAAO;IAEvB,OAAO,CAAC,cAAc,CAAC,oBAAoB,CACzC,IAAI,yBAAe,CAAC;QAClB,MAAM,EAAE,gBAAM,CAAC,IAAI;QACnB,OAAO,EAAE,cAAc;QACvB,SAAS,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC;QACpD,UAAU,EAAE,EAAE,eAAe,EAAE,EAAE,6BAA6B,EAAE,YAAY,CAAC,SAAS,CAAC,EAAE,EAAE;KAC5F,CAAC,CACH,CAAC;IACF,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,UAAU,CAAC,SAA6B,EAAE,OAAmB;IACpE,eAAQ,CAAC,cAAc,CAAC;QACtB,OAAO;QACP,OAAO,EAAE,CAAC,wBAAwB,CAAC;QACnC,YAAY,EAAE,CAAC,SAAS,CAAC,YAAY,CAAC;KACvC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACU,QAAA,WAAW,GAAG;IACzB;;;;;;;;;;OAUG;IACH,MAAM,EAAE,CACN,MAAmC,EACnC,EAAE,gBAAgB,KAA8B,EAAE,EAC/B,EAAE,CACrB,IAAA,eAAQ,EACN,IAAA,cAAO,EAAC,EAAE,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC,EAChD,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,OAAmB,EAAE,EAAE;QACvD,WAAW,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAC5C,CAAC,CACF;CACJ,CAAC;AAEF;;;;GAIG;AACU,QAAA,eAAe,GAAG;IAC7B;;;OAGG;IACH,KAAK,EAAE,CAAC,SAAyC,EAAqB,EAAE,CACtE,IAAA,eAAQ,EAAC,SAAS,EAAE,CAAC,QAAQ,EAAE,OAAmB,EAAE,EAAE;QACpD,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAChC,CAAC,CAAC;CACL,CAAC"}
+{"version":3,"file":"grants.js","sourceRoot":"","sources":["../../src/grants.ts"],"names":[],"mappings":";;;AAAA,iDAAkG;AAElG,6CAAoF;AAEpF,qCAAqD;AACrD,+DAK+B;AAE/B,MAAM,aAAa,GAAG,qBAAqB,CAAC;AAE5C;;;;;GAKG;AACH,MAAM,cAAc,GAAG,CAAC,aAAa,EAAE,uCAAuC,CAAC,CAAC;AAoChF;;;;GAIG;AACH,SAAS,eAAe,CAAC,KAA6B;IACpD,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAA,sBAAa,EAAC,KAAK,CAAC,CAAC;IAC5D,OAAO,IAAA,mBAAU,EAAC,SAAS,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,aAAa,CACpB,SAAqC,EACrC,KAA6B;IAE7B,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QACnC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;IACxD,CAAC;IACD,OAAO;QACL,IAAI,EAAE,KAAK;QACX,UAAU,EAAE,GAAG,SAAS,CAAC,YAAY,IAAI,SAAS,CAAC,OAAO,EAAE;QAC5D,QAAQ,EAAE,SAAS,CAAC,YAAY;KACjC,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CACpB,UAA6C,EAC7C,QAA8B;IAE9B,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,cAAc,CAAC;IAC5D,OAAO;QACL,GAAG,UAAU;QACb,CAAC,KAAK,CAAC,EAAE;YACP,GAAG,UAAU,EAAE,CAAC,KAAK,CAAC;YACtB,6BAA6B,EAAE,QAAQ,CAAC,UAAU;SACnD;KACF,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAClB,MAAuB,EACvB,OAAmB,EACnB,SAAiD,EACjD,SAAkB;IAElB,MAAM,KAAK,GAAG,IAAA,6BAAO,EAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;IAC7D,MAAM,UAAU,GAAG,IAAA,0CAAoB,EAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,SAAS,IAAI,aAAa,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC9D,KAAK,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,UAAU,EAAE,CAAC;QACtD,eAAQ,CAAC,cAAc,CAAC;YACtB,OAAO;YACP,OAAO;YACP,YAAY;YACZ,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU;SACxE,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,QAAQ;QAAE,OAAO;IAEtB,OAAO,CAAC,cAAc,CAAC,oBAAoB,CACzC,IAAI,yBAAe,CAAC;QAClB,MAAM,EAAE,gBAAM,CAAC,IAAI;QACnB,OAAO;QACP,SAAS,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC;QACpD,UAAU,EAAE;YACV,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,iBAAiB,CAAC,EAAE;gBACrD,6BAA6B,EAAE,QAAQ,CAAC,UAAU;aACnD;SACF;KACF,CAAC,CACH,CAAC;IACF,UAAU,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,UAAU,CAAC,YAAoB,EAAE,OAAmB;IAC3D,eAAQ,CAAC,cAAc,CAAC;QACtB,OAAO;QACP,OAAO,EAAE,CAAC,wBAAwB,CAAC;QACnC,YAAY,EAAE,CAAC,YAAY,CAAC;KAC7B,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACU,QAAA,WAAW,GAAG;IACzB;;;;;;;;;;OAUG;IACH,MAAM,EAAE,CACN,MAAmC,EACnC,EAAE,gBAAgB,EAAE,SAAS,GAAG,IAAI,KAA8B,EAAE,EACjD,EAAE,CACrB,IAAA,eAAQ,EACN,IAAA,cAAO,EAAC,EAAE,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC,EAChD,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,OAAmB,EAAE,EAAE;QACvD,WAAW,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IACvD,CAAC,CACF;CACJ,CAAC;AAEF;;;;GAIG;AACU,QAAA,eAAe,GAAG;IAC7B;;;OAGG;IACH,KAAK,EAAE,CAAC,SAAyC,EAAqB,EAAE,CACtE,IAAA,eAAQ,EAAC,SAAS,EAAE,CAAC,QAAQ,EAAE,OAAmB,EAAE,EAAE;QACpD,UAAU,CAAC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAC7C,CAAC,CAAC;IACJ;;;;OAIG;IACH,4EAA4E;IAC5E,wCAAwC;IACxC,QAAQ,EAAE,GAAsB,EAAE,CAAC,CAAC;QAClC,OAAO,CAAC,OAAO;YACb,UAAU,CAAC,eAAe,CAAC,IAAA,6BAAO,EAAC,OAAO,CAAC,cAAc,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACxE,CAAC;KACF,CAAC;CACH,CAAC"}

package/dist/commonjs/index.d.ts

@@ -1,6 +1,6 @@
 export { type ApplicationInferenceProfileBuilderProps, type ApplicationInferenceProfileBuilderResult, createApplicationInferenceProfileBuilder, type IApplicationInferenceProfileBuilder, } from "./application-inference-profile-builder.js";
 export { type ApplicationInferenceProfile, foundationModelFor, type GeographicInferenceProfile, type GeographicInferenceProfileOptions, type GlobalInferenceProfile, INFERENCE_PROFILE_GEOGRAPHIES, type InferenceProfile, type InferenceProfileGeography, inferenceProfile, } from "./inference-profile.js";
-export { type InferenceTarget, invocationArns } from "./inference-target.js";
+export { type InferenceTarget, type InferenceTargetIdOptions, inferenceTarget, invocationArns, } from "./inference-target.js";
 export { guardrailGrants, type ModelInvokeGrantOptions, modelGrants } from "./grants.js";
 export { createGuardrailBuilder, type GuardrailBuilderProps, type GuardrailBuilderResult, type GuardrailReference, type IGuardrailBuilder, } from "./guardrail-builder.js";
 export { GUARDRAIL_DEFAULTS } from "./guardrail-defaults.js";

package/dist/commonjs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,uCAAuC,EAC5C,KAAK,wCAAwC,EAC7C,wCAAwC,EACxC,KAAK,mCAAmC,GACzC,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,KAAK,2BAA2B,EAChC,kBAAkB,EAClB,KAAK,0BAA0B,EAC/B,KAAK,iCAAiC,EACtC,KAAK,sBAAsB,EAC3B,6BAA6B,EAC7B,KAAK,gBAAgB,EACrB,KAAK,yBAAyB,EAC9B,gBAAgB,GACjB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,KAAK,eAAe,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC7E,OAAO,EAAE,eAAe,EAAE,KAAK,uBAAuB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACzF,OAAO,EACL,sBAAsB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,GACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,uBAAuB,EACvB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,GAC7B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,KAAK,gBAAgB,EAAE,KAAK,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AACvF,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,KAAK,gBAAgB,EAAE,KAAK,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC3F,OAAO,EACL,mCAAmC,EACnC,KAAK,8BAA8B,EACnC,iCAAiC,EACjC,KAAK,kCAAkC,EACvC,KAAK,mCAAmC,EACxC,KAAK,gCAAgC,GACtC,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,uCAAuC,EACvC,KAAK,iCAAiC,GACvC,MAAM,sCAAsC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,uCAAuC,EAC5C,KAAK,wCAAwC,EAC7C,wCAAwC,EACxC,KAAK,mCAAmC,GACzC,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,KAAK,2BAA2B,EAChC,kBAAkB,EAClB,KAAK,0BAA0B,EAC/B,KAAK,iCAAiC,EACtC,KAAK,sBAAsB,EAC3B,6BAA6B,EAC7B,KAAK,gBAAgB,EACrB,KAAK,yBAAyB,EAC9B,gBAAgB,GACjB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,wBAAwB,EAC7B,eAAe,EACf,cAAc,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,eAAe,EAAE,KAAK,uBAAuB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACzF,OAAO,EACL,sBAAsB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,GACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,uBAAuB,EACvB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,GAC7B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,KAAK,gBAAgB,EAAE,KAAK,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AACvF,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,KAAK,gBAAgB,EAAE,KAAK,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC3F,OAAO,EACL,mCAAmC,EACnC,KAAK,8BAA8B,EACnC,iCAAiC,EACjC,KAAK,kCAAkC,EACvC,KAAK,mCAAmC,EACxC,KAAK,gCAAgC,GACtC,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,uCAAuC,EACvC,KAAK,iCAAiC,GACvC,MAAM,sCAAsC,CAAC"}

package/dist/commonjs/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.MODEL_INVOCATION_LOGGING_ALARM_DEFAULTS = exports.MODEL_INVOCATION_LOGGING_DEFAULTS = exports.createModelInvocationLoggingBuilder = exports.modelMetrics = exports.MODEL_ALARM_DEFAULTS = exports.createModelAlarmBuilder = exports.guardrailMetrics = exports.GUARDRAIL_DEFAULTS = exports.createGuardrailBuilder = exports.modelGrants = exports.guardrailGrants = exports.invocationArns = exports.inferenceProfile = exports.INFERENCE_PROFILE_GEOGRAPHIES = exports.foundationModelFor = exports.createApplicationInferenceProfileBuilder = void 0;
+exports.MODEL_INVOCATION_LOGGING_ALARM_DEFAULTS = exports.MODEL_INVOCATION_LOGGING_DEFAULTS = exports.createModelInvocationLoggingBuilder = exports.modelMetrics = exports.MODEL_ALARM_DEFAULTS = exports.createModelAlarmBuilder = exports.guardrailMetrics = exports.GUARDRAIL_DEFAULTS = exports.createGuardrailBuilder = exports.modelGrants = exports.guardrailGrants = exports.invocationArns = exports.inferenceTarget = exports.inferenceProfile = exports.INFERENCE_PROFILE_GEOGRAPHIES = exports.foundationModelFor = exports.createApplicationInferenceProfileBuilder = void 0;
 var application_inference_profile_builder_js_1 = require("./application-inference-profile-builder.js");
 Object.defineProperty(exports, "createApplicationInferenceProfileBuilder", { enumerable: true, get: function () { return application_inference_profile_builder_js_1.createApplicationInferenceProfileBuilder; } });
 var inference_profile_js_1 = require("./inference-profile.js");
@@ -8,6 +8,7 @@ Object.defineProperty(exports, "foundationModelFor", { enumerable: true, get: fu
 Object.defineProperty(exports, "INFERENCE_PROFILE_GEOGRAPHIES", { enumerable: true, get: function () { return inference_profile_js_1.INFERENCE_PROFILE_GEOGRAPHIES; } });
 Object.defineProperty(exports, "inferenceProfile", { enumerable: true, get: function () { return inference_profile_js_1.inferenceProfile; } });
 var inference_target_js_1 = require("./inference-target.js");
+Object.defineProperty(exports, "inferenceTarget", { enumerable: true, get: function () { return inference_target_js_1.inferenceTarget; } });
 Object.defineProperty(exports, "invocationArns", { enumerable: true, get: function () { return inference_target_js_1.invocationArns; } });
 var grants_js_1 = require("./grants.js");
 Object.defineProperty(exports, "guardrailGrants", { enumerable: true, get: function () { return grants_js_1.guardrailGrants; } });

package/dist/commonjs/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;AAAA,uGAKoD;AAFlD,oKAAA,wCAAwC,OAAA;AAG1C,+DAUgC;AAR9B,0HAAA,kBAAkB,OAAA;AAIlB,qIAAA,6BAA6B,OAAA;AAG7B,wHAAA,gBAAgB,OAAA;AAElB,6DAA6E;AAA9C,qHAAA,cAAc,OAAA;AAC7C,yCAAyF;AAAhF,4GAAA,eAAe,OAAA;AAAgC,wGAAA,WAAW,OAAA;AACnE,+DAMgC;AAL9B,8HAAA,sBAAsB,OAAA;AAMxB,iEAA6D;AAApD,2HAAA,kBAAkB,OAAA;AAC3B,6DAI+B;AAD7B,uHAAA,gBAAgB,OAAA;AAElB,mEAKkC;AAJhC,iIAAA,uBAAuB,OAAA;AAMzB,qEAAiE;AAAxD,+HAAA,oBAAoB,OAAA;AAC7B,qDAA2F;AAAxC,+GAAA,YAAY,OAAA;AAC/D,6FAO+C;AAN7C,0JAAA,mCAAmC,OAAA;AAEnC,wJAAA,iCAAiC,OAAA;AAKnC,2FAG8C;AAF5C,6JAAA,uCAAuC,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;AAAA,uGAKoD;AAFlD,oKAAA,wCAAwC,OAAA;AAG1C,+DAUgC;AAR9B,0HAAA,kBAAkB,OAAA;AAIlB,qIAAA,6BAA6B,OAAA;AAG7B,wHAAA,gBAAgB,OAAA;AAElB,6DAK+B;AAF7B,sHAAA,eAAe,OAAA;AACf,qHAAA,cAAc,OAAA;AAEhB,yCAAyF;AAAhF,4GAAA,eAAe,OAAA;AAAgC,wGAAA,WAAW,OAAA;AACnE,+DAMgC;AAL9B,8HAAA,sBAAsB,OAAA;AAMxB,iEAA6D;AAApD,2HAAA,kBAAkB,OAAA;AAC3B,6DAI+B;AAD7B,uHAAA,gBAAgB,OAAA;AAElB,mEAKkC;AAJhC,iIAAA,uBAAuB,OAAA;AAMzB,qEAAiE;AAAxD,+HAAA,oBAAoB,OAAA;AAC7B,qDAA2F;AAAxC,+GAAA,YAAY,OAAA;AAC/D,6FAO+C;AAN7C,0JAAA,mCAAmC,OAAA;AAEnC,wJAAA,iCAAiC,OAAA;AAKnC,2FAG8C;AAF5C,6JAAA,uCAAuC,OAAA"}

package/dist/commonjs/inference-profile.d.ts

@@ -9,7 +9,7 @@ import { FoundationModelIdentifier } from "aws-cdk-lib/aws-bedrock";
  *
  * @see https://docs.aws.amazon.com/bedrock/latest/userguide/geographic-cross-region-inference.html
  */
-export declare const INFERENCE_PROFILE_GEOGRAPHIES: readonly ["us", "eu", "apac", "jp", "au", "us-gov"];
+export declare const INFERENCE_PROFILE_GEOGRAPHIES: readonly ["us", "eu", "apac", "jp", "au", "in", "us-gov"];
 /** A known geography prefix. See {@link INFERENCE_PROFILE_GEOGRAPHIES}. */
 export type InferenceProfileGeography = (typeof INFERENCE_PROFILE_GEOGRAPHIES)[number];
 /**
@@ -26,11 +26,18 @@ export interface GeographicInferenceProfile {
     /** The id to invoke, e.g. `eu.anthropic.claude-haiku-4-5-20251001-v1:0`. */
     readonly profileId: string;
     /**
-     * Every Region the profile may route to from the source Region, as listed
-     * by `aws bedrock get-inference-profile` or the model's page in the Bedrock
-     * user guide. The source Region is always granted, listed or not.
+     * The Regions the profile routes to from the source Region, as listed by
+     * `aws bedrock get-inference-profile`. AWS chooses and extends that list,
+     * so a copy of it is a snapshot. Bedrock checks the model in every Region
+     * the profile may route to, so once AWS adds one, a grant built from the
+     * copy denies every call through the profile.
+     *
+     * Omitted, the grant covers the foundation model in every Region, still
+     * only through this profile. List the Regions when the policy must name
+     * each one, for a service control policy or a policy scanner. The source
+     * Region is always granted.
      */
-    readonly routingRegions: readonly string[];
+    readonly routingRegions?: readonly string[];
 }
 /**
  * A system-defined inference profile that routes requests to any supported
@@ -68,10 +75,20 @@ export interface ApplicationInferenceProfile {
 }
 /** Options for {@link inferenceProfile.geographic}. */
 export type GeographicInferenceProfileOptions = Pick<GeographicInferenceProfile, "model" | "geography" | "routingRegions">;
+/**
+ * The segment of `id` before its first dot, and whether it marks a
+ * system-defined profile id. Undefined when `id` has no such segment.
+ * @internal
+ */
+export declare function idPrefix(id: string): {
+    prefix: string;
+    isProfile: boolean;
+} | undefined;
+/** Throws unless `id` is a non-empty literal string. @internal */
+export declare function assertLiteralId(id: string, label: string): void;
 declare function geographic(options: GeographicInferenceProfileOptions): GeographicInferenceProfile;
 declare function global(model: FoundationModelIdentifier): GlobalInferenceProfile;
-declare function parse(profileId: string): GlobalInferenceProfile;
-declare function parse(profileId: string, routingRegions: readonly string[]): InferenceProfile;
+declare function parse(profileId: string, routingRegions?: readonly string[]): InferenceProfile;
 /**
  * Factories for {@link InferenceProfile} values.
  *
@@ -80,7 +97,6 @@ declare function parse(profileId: string, routingRegions: readonly string[]): In
  * const haiku = inferenceProfile.geographic({
  *   model: FoundationModelIdentifier.ANTHROPIC_CLAUDE_HAIKU_4_5_20251001_V1_0,
  *   geography: "eu",
- *   routingRegions: ["eu-central-1", "eu-north-1", "eu-south-1", "eu-south-2", "eu-west-1", "eu-west-3"],
  * });
  * haiku.profileId; // "eu.anthropic.claude-haiku-4-5-20251001-v1:0"
  * ```
@@ -93,7 +109,7 @@ export declare const inferenceProfile: {
     /**
      * Reads a profile id such as `eu.anthropic.claude-haiku-4-5-20251001-v1:0`.
      * Throws unless the id starts with a known geography or `global`. A
-     * geographic id needs its `routingRegions`; a global id takes none.
+     * geographic id may take its `routingRegions`; a global id takes none.
      */
     parse: typeof parse;
 };

package/dist/commonjs/inference-profile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"inference-profile.d.ts","sourceRoot":"","sources":["../../src/inference-profile.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAEpE;;;;;;;;;GASG;AACH,eAAO,MAAM,6BAA6B,qDAAsD,CAAC;AAEjG,2EAA2E;AAC3E,MAAM,MAAM,yBAAyB,GAAG,CAAC,OAAO,6BAA6B,CAAC,CAAC,MAAM,CAAC,CAAC;AAIvF;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,yBAAyB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAC9D,+CAA+C;IAC/C,QAAQ,CAAC,KAAK,EAAE,yBAAyB,CAAC;IAC1C,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5C;AAED;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,+CAA+C;IAC/C,QAAQ,CAAC,KAAK,EAAE,yBAAyB,CAAC;IAC1C,gFAAgF;IAChF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,uDAAuD;AACvD,MAAM,MAAM,gBAAgB,GAAG,0BAA0B,GAAG,sBAAsB,CAAC;AAEnF;;;;;;GAMG;AACH,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,6DAA6D;IAC7D,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,kCAAkC;IAClC,QAAQ,CAAC,MAAM,EAAE,yBAAyB,GAAG,gBAAgB,CAAC;CAC/D;AAED,uDAAuD;AACvD,MAAM,MAAM,iCAAiC,GAAG,IAAI,CAClD,0BAA0B,EAC1B,OAAO,GAAG,WAAW,GAAG,gBAAgB,CACzC,CAAC;AA4CF,iBAAS,UAAU,CAAC,OAAO,EAAE,iCAAiC,GAAG,0BAA0B,CAiB1F;AAED,iBAAS,MAAM,CAAC,KAAK,EAAE,yBAAyB,GAAG,sBAAsB,CAGxE;AAaD,iBAAS,KAAK,CAAC,SAAS,EAAE,MAAM,GAAG,sBAAsB,CAAC;AAC1D,iBAAS,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,SAAS,MAAM,EAAE,GAAG,gBAAgB,CAAC;AAkBvF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,gBAAgB;IAC3B,8CAA8C;;IAE9C,4DAA4D;;IAE5D;;;;OAIG;;CAEJ,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,yBAAyB,CAE/E"}
+{"version":3,"file":"inference-profile.d.ts","sourceRoot":"","sources":["../../src/inference-profile.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAEpE;;;;;;;;;GASG;AACH,eAAO,MAAM,6BAA6B,2DAQhC,CAAC;AAEX,2EAA2E;AAC3E,MAAM,MAAM,yBAAyB,GAAG,CAAC,OAAO,6BAA6B,CAAC,CAAC,MAAM,CAAC,CAAC;AAMvF;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,yBAAyB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAC9D,+CAA+C;IAC/C,QAAQ,CAAC,KAAK,EAAE,yBAAyB,CAAC;IAC1C,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7C;AAED;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,+CAA+C;IAC/C,QAAQ,CAAC,KAAK,EAAE,yBAAyB,CAAC;IAC1C,gFAAgF;IAChF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,uDAAuD;AACvD,MAAM,MAAM,gBAAgB,GAAG,0BAA0B,GAAG,sBAAsB,CAAC;AAEnF;;;;;;GAMG;AACH,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,6DAA6D;IAC7D,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,kCAAkC;IAClC,QAAQ,CAAC,MAAM,EAAE,yBAAyB,GAAG,gBAAgB,CAAC;CAC/D;AAED,uDAAuD;AACvD,MAAM,MAAM,iCAAiC,GAAG,IAAI,CAClD,0BAA0B,EAC1B,OAAO,GAAG,WAAW,GAAG,gBAAgB,CACzC,CAAC;AAKF;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,GAAG,SAAS,CAKvF;AAED,kEAAkE;AAClE,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAI/D;AA4BD,iBAAS,UAAU,CAAC,OAAO,EAAE,iCAAiC,GAAG,0BAA0B,CAiB1F;AAED,iBAAS,MAAM,CAAC,KAAK,EAAE,yBAAyB,GAAG,sBAAsB,CAGxE;AAcD,iBAAS,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,gBAAgB,CAYtF;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,gBAAgB;IAC3B,8CAA8C;;IAE9C,4DAA4D;;IAE5D;;;;OAIG;;CAEJ,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,yBAAyB,CAE/E"}